This is a great course that distinguishes the challenges and integration points for ICS and Traditional IT security posture. The instructors provide in-depth real world knowledge and experience to the material to make it actionable within the attendee's corporate environment.

Rob Oates, GDIT

SANS has joined forces with industry leaders to equip security professionals and control system engineers with the cybersecurity skills they need to defend national critical infrastructure. ICS410: ICS/SCADA Security Essentials provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in supporting and defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats.

When examining the greatest risks and needs in critical infrastructure sectors, the course authors looked carefully at the core security principles necessary for the range of tasks involved in supporting control systems on a daily basis. While other courses are available for higher-level security practitioners who need to develop specific skills such as industrial control system penetration testing, vulnerability analysis, malware analysis, forensics, secure coding, and red team training, most of these courses do not focus on the people who operate, manage, design, implement, monitor, and integrate critical infrastructure production control systems.

With the dynamic nature of industrial control systems, many engineers do not fully understand the features and risks of many devices. In addition, IT support personnel who provide the communications paths and network defenses do not always grasp the systems' operational drivers and constraints. This course is designed to help traditional IT personnel fully understand the design principles underlying control systems and how to support those systems in a manner that ensures availability and integrity. In parallel, the course addresses the need for control system engineers and operators to better understand the important role they play in cybersecurity. This starts by ensuring that a control system is designed and engineered with cybersecurity built into it, and that cybersecurity has the same level of focus as system reliability throughout the system lifecycle.

When these different groups of professionals complete this course, they will have developed an appreciation, understanding, and common language that will enable them to work together to secure their industrial control system environments. The course will help develop cyber-secure-aware engineering practices and real-time control system IT /OT support carried out by professionals who understand the physical effects of actions in the cyber world.

Please note that some course material for SEC401 may overlap with ICS410. We recommend ICS410 for those interested in security for an ICS/SCADA environment as it is approached from this viewpoint, and SEC401 for those primarily interested in a general information security course.

Course Syllabus

ICS410.1: ICS Overview

Overview

Takeaway: Students will develop and reinforce a common language and understanding of Industrial Control System (ICS) cybersecurity as well as the important considerations that come with cyber-to-physical operations within these environments. Each student will receive programmable logic controller (PLC) hardware to keep. The PLC contains physical inputs and outputs that will be programmed in class and mapped to an operator interface, or HMI, also created in class. This improved hardware-enabled approach provides the necessary cyber-to-physical knowledge that allows students to better understand important ICS operational drivers and constraints that require specific safety protection, communications needs, system management approaches, and cybersecurity implementations. Essential terms, architectures, methodologies, and devices are all covered to build a common language for students from a variety of different roles.

CPE/CMU Credits: 6

Topics

Day 1 ICS Overview

Global Industrial Cybersecurity Professional (GICSP) Overview

Overview of ICS

Processes & Roles

Industries

Field Components

Real-Time Operating Systems

Programming Controllers

Exercise: PLC Programming

Supervisory Components

Specialized Applications

Master Servers

Exercise: HMI Programming

Types of ICS Systems

DCS vs. SCADA

IT & ICS Differences

ICS Lifecycle Challenges

Physical Security

ICS Network Architecture

Network Models

Design Example

Exercise: Architecting a Secure DCS

ICS410.2: ICS Attack Surface

Overview

Takeaway: If you know the adversary's approaches to attacking an ICS environment, you will be better prepared to defend that environment. Numerous attack vectors exist within an ICS environment. Some are similar to traditional IT systems, while others are more specific to ICS. During Day 2 defenders will develop a better understanding of where these specific attack vectors exist, as well as the tools to use to discover vulnerabilities and exploit them. Each student will use a vulnerable target virtual machine to further understand attacks targeting the types of web servers used on many ICS devices for management purposes. Simulators will be configured to allow students to conduct attacks against unauthenticated ICS protocols. A variety of data samples are used to examine additional attack vectors on remote devices.

CPE/CMU Credits: 6

Topics

Day 2: ICS Attack Surface

ICS Attack Surface

Exercise: Information Leakage

Attacks on HMIs and UIs

Intro to SamuraiSTFU

Exercise: Password Fuzzing

Web Attacks

Exercise: Authentication Bypass with SQL Injection

Attacks on Control Servers

Attacks on Network Communications

Exercise: Spoofing Modbus

Attacks on Remote Devices

Exercise: Analyzing Firmware

Firmware Attacks

ICS410.3: Defending ICS Servers and Workstations

Overview

Takeaway: Students will learn essential ICS-related server and workstation operating system capabilities, implementation approaches, and system management practices. Students will receive and work with both Windows- and Linux-based virtual machines in order to understand how to monitor and harden these hosts from attack. Students will examine concepts that benefit ICS systems such as system hardening, log management, monitoring, alerting, and audit approaches, then look at some of the more common applications and databases used in ICS environments across multiple industries.

CPE/CMU Credits: 6

Topics

Day 3: Defending ICS Servers and Workstations

Windows in ICS

Linux/Unix in ICS

Updates and Patching

Processes and Services

Configuration Hardening

Exercise: Bastille Linux

Endpoint Defenses

Exercise: Firewalls

Automation and Auditing

Exercise: Powershell

Log Management

Exercise: Windows Logs

Databases and Historians

ICS410.4: Defending ICS Networks and Devices

Overview

Takeaway: With an understanding of the ICS environment, the attack vectors that exist, and the defender-specific capabilities available on servers, workstations, and applications, students will now learn network-specific defense approaches. We'll first examine common IT protocols and network components used within ICS environments, then discuss ICS-specific protocols and devices. Technologies used to defend ICS networks will be reviewed along with implementation approaches. Students will interact with ICS traffic and develop skills to analyze it, then work through a number of tools to further explore a series of staged adversary actions conducted in a lab environment.

CPE/CMU Credits: 6

Topics

Day 4: Defending ICS Networks and Devices

Network Fundamentals

Ethernet

TCP/IP Protocol Suite

ICS Protocols over TCP/IP

Exercise: Network Capture Analysis

Enforcement Zone Devices

Firewalls

Unidirectional Gateways

Honeypots

Wireless in Control Systems

Satellite Protocols

Mesh Protocols

Bluetooth and WiFi

Defenses

Exercise: Network Capture Forensics

Field and Plant Floor Equipment

Cryptography Fundamentals

ICS410.5: ICS Security Governance

Overview

Takeaway: Students will learn about the various models, methodologies, and industry-specific regulations that are used to govern what must be done to protect critical ICS systems. Key business processes that consider risk assessments, disaster recovery, business impact analysis, and contingency planning will be examined from the perspective of ICS environments. On this final course day, students will work together on an incident response exercise that places them squarely in an ICS environment that is under attack. This exercise ties together key aspects of what has been learned throughout the course and presents students with a scenario to review with their peers. Specific incident-response roles and responsibilities are considered, and actions available to defenders throughout the incident response cycle are explored. Students will leave with a variety of resources for multiple industries and will be well prepared to pursue the GICSP, an important ICS-focused professional certification.

CPE/CMU Credits: 6

Topics

Day 5: ICS Security Governance

Information Assurance Foundations

Data Classification

Depth in Defense

Security Policies

Policy Hierarchy

Policy Governance

Contingency and Continuity Planning

Risk Assessment and Auditing

Risk Governance

Calculating Risk

Exercise: Attack Tree Analysis

Password Management

Incident Handling

Six Steps

Table Top Exercise

Exercise: Incident Response

Resources

Additional Information

Laptop Required

The ICS410 Industrial Control System Security Essentials course consists of instruction and hands-on exercises. The exercises are designed to allow students to put knowledge gained throughout the course into practice in an instructor-led environment. Students will have the opportunity to install, configure, and use the tools and techniques that they have learned.

NOTE: Do not bring a regular production laptop for this class! When installing software, there is always a chance of breaking something else on the system. Students should assume that all data could be lost.

NOTE: It is critical that students have administrator access to the operating system and the ability to disable all security software installed. Changes may need to be made to personal firewalls and other host-based software in order for the labs to work.

Laptop requirements include the following:

64-bit processor with 64-bit operating system

VT or other 64-bit virtualization settings enabled in your BIOS to run 64-bit VMs

At least eight (8) GB of RAM

At least fifty (50) GB of free hard drive space

At least one USB port

VMware Player 12, VMware Workstation 12, or VWware Fusion 8 installed BEFORE class. Other virtualization software such as Parallels or VirtualBox may work if the attendee is familiar with its functionality, however VMware should be pre-installed as a backup just in case

Access to an account with administrative permissions and the ability to disable all security software on their laptop such as Antivirus and/or firewalls if needed for the class

If you are using Linux for your host machine, you will need ExFAT drivers installed for the USB drive

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

Who Should Attend

The course is designed for the range of individuals who work in, interact with, or can affect industrial control system environments, including asset owners, vendors, integrators, and other third parties. These personnel primarily come from four domains:

IT (includes operational technology support)

IT security (includes operational technology security)

Engineering

Corporate, industry, and professional standards

Prerequisites

Course participants need to have a basic understanding of networking and system administration, TCP/IP, networking design/architecture, vulnerability assessment, and risk methodologies. ICS410 covers many of the core areas of security and assumes a basic understanding of technology, networks, and security. For those who are brand new to the field and have no background knowledge, SEC301: Intro to Information Security would be the recommended starting point. While SEC301 is not a prerequisite, it provides introductory knowledge that will help maximize a student's experience with ICS410.

What You Will Receive

Software tools

Virtual Machine environments will be utilized throughout the labs

MP3 audio files of the complete course lecture

A license to Windows 10 and a hardware PLC for students to use in class and take home with them

You Will Be Able To

Run Windows command line tools to analyze the system looking for high-risk items

Run Linux command line tools (ps, ls, netstat, ect) and basic scripting to automate the running of programs to perform continuous monitoring of various tools

Install VMWare and create virtual machines to create a virtual lab to test and evaluate tools/security of systems

Better understand various industrial control systems and their purpose, application, function, and dependencies on network IP and industrial communications

Author Statement

Eric Cole, Eric Cornelius, and Justin Searle

This course provides students with the essentials for conducting cybersecurity work in industrial control system environments. After spending years working with industry, we believe there is a gap in the skill sets of industrial control system personnel, whether it be cybersecurity skills for engineers or engineering principles for cybersecurity experts. In addition, both information technology and operational technology roles have converged in today's industrial control system environments, so there is a greater need than ever for a common understanding between the various groups who support or rely on these systems. Students in ICS410 will learn the language, the underlying theory, and the basic tools for industrial control system security in settings across a wide range of industry sectors and applications.

Additional Resources

Take your learning beyond the classroom. Explore our site network for additional resources related to this course's subject matter.